What this check looks at
Checks that an assigned Intune compliance policy for Windows requires BitLocker, the Windows firewall and antivirus, so a device without them is marked non-compliant.
An Intune compliance policy defines what a healthy device is. A device that does not meet it is marked non-compliant, and Conditional Access policies that require a compliant device then keep it out of Microsoft 365. For Windows, the settings that matter most are Require BitLocker (Device Health), Encryption of data storage, Firewall and Antivirus (System Security), and Microsoft Defender Antimalware and Real-time protection (Defender). Each is Not configured until someone sets it to Require, and Not configured means it is not checked.
The check looks at Windows compliance policies that are assigned to someone. It fails when Windows devices exist but there is no Windows compliance policy, when none of the policies is assigned, or when no assigned policy requires BitLocker (or encryption of data storage) or antivirus (or Microsoft Defender Antimalware). It warns when only the firewall or real-time protection requirement is missing, and passes when the assigned policies between them require all four.
A compliance policy that does not require these lets a laptop with BitLocker suspended, the firewall off and Defender disabled, by a user or by malware, count as compliant, and Conditional Access trusts it fully. A lost unencrypted laptop hands its cached files and signed-in sessions to whoever finds it; a device with antivirus turned off is where ransomware starts.
Why it matters
Encryption, a firewall and antivirus are the minimum every framework and insurer expects on a laptop. If the compliance policy does not require them, a device can have them switched off and still count as healthy, and Conditional Access will let it in.
A typical case: a consultant’s laptop is stolen from a car. BitLocker was never turned on because the device was built before the encryption policy, and the compliance policy did not require it, so nobody knew. The disk holds synced client folders. Because the data was not encrypted, the loss is a breach the firm must assess for the ICO and tell its clients about; with BitLocker, the ICO’s guidance treats it as a lost device with the data protected.
Cyber insurance proposal forms ask whether laptops are encrypted and antivirus is running everywhere. If a claim follows an incident on a device without them, the insurer can question the cover.
Cyber Essentials requires malware protection on every device in scope, and Cyber Essentials Plus tests it on a sample of devices. This check also supports ISO 27001 A.8.1 and A.8.7, PCI DSS 5.2.1 and 5.3.1, and the NCSC Cyber Assessment Framework’s B4.b on secure configuration.
How to fix it
Where: Intune admin centre → Devices → Compliance → Policies
Before you start
- Check which setting is missing from the evidence and whether devices already meet it, to avoid a wave of non-compliance.
Step by step
- Look at the current Windows compliance policies. In the Microsoft Intune admin centre, go to Devices > Compliance and filter on Windows 10 and later. Open each policy and check its Assignments and which of BitLocker, encryption, firewall, antivirus and real-time protection it requires.
- Check how many devices would fail. Before requiring anything, look at Devices > Monitor > Encryption report for devices not encrypted, and Endpoint security > Antivirus for devices with protection off. Fix those first, or give the policy a grace period, so the change does not cut people off.
- Require the settings in a Windows compliance policy. Edit the existing policy, or select Create policy with platform Windows 10 and later. Under Compliance settings set: Device Health > Require BitLocker = Require; System Security > Encryption of data storage on device = Require, Firewall = Require, Antivirus = Require, Antispyware = Require; Defender > Microsoft Defender Antimalware = Require and Real-time protection = Require. If the business uses another antivirus product, leave Microsoft Defender Antimalware not configured and rely on Antivirus = Require.
- Set a grace period and assign it. Under Actions for noncompliance, keep "Mark device noncompliant" and set a schedule of a few days, and add an email to the user if you want one. Under Assignments, include All users (or All devices), then Review + create or Save.
- Turn BitLocker on where it is off. Go to Endpoint security > Disk encryption > Create policy, platform Windows, profile BitLocker. Turn on Require Device Encryption, allow standard users to encrypt so it runs silently, and require recovery keys to be backed up to Microsoft Entra ID before encryption starts. Assign it to the same users or devices.
- Confirm the change. Open the compliance policy and its per-setting status: BitLocker, firewall, antivirus and real-time protection are listed as required, and devices report Compliant as they check in. Devices > Monitor > Encryption report shows devices encrypted with a recovery key stored.
What users will notice
Devices missing the setting become non-compliant until it is fixed; with a compliance Conditional Access policy they can lose access.
How to confirm it worked
The Windows compliance policy shows BitLocker, firewall, antivirus and real-time protection as required, and is assigned.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware softwareES-3 Ensure anti-malware software and signatures are updatedDP-4 Enable data at rest encryption by default |
| Zero Trust | Endpoints |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.2.1 An anti-malware solution is deployed on all system components5.3.1 The anti-malware solution is kept current |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code3.13.16 Protect the confidentiality of CUI at rest |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code ProtectionSC.L2-3.13.16 Data at Rest |
| ISO 27001:2022 | A.8.1 User endpoint devicesA.8.7 Protection against malware |
| CIS Controls v8.1 | 3.6 Encrypt data on end-user devices (IG1)4.5 Implement and manage a firewall on end-user devices (IG1)10.1 Deploy and maintain anti-malware software (IG1) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Windows compliance settings in Intune (Microsoft Learn)